This update fixes several security issues in the Apache webserver.

The patch for the ByteRange remote denial of service attack (CVE-2011-3192) was refined and the configuration options used by upstream were added. Introduce new config option: Allow MaxRanges Number of ranges requested, if exceeded, the complete content is served. default: 200 0|unlimited: unlimited none: Range headers are ignored. This option is a backport from 2.2.21.

Also fixed: CVE-2011-3348: Denial of service in proxy_ajp when using a undefined method.

CVE-2011-3368: Exposure of internal servers via reverse proxy methods with mod_proxy enabled and incorrect Rewrite or Proxy Rules.

The version of Apache HTTP Server running on the remote host is affected by an information disclosure vulnerability. When configured as a reverse proxy, improper use of the RewriteRule and ProxyPassMatch directives could cause the web server to proxy requests to arbitrary hosts. This allows a remote attacker to indirectly send requests to intranet servers.

According to its banner, the version of Apache 2.2.x installed on the remote host is prior to 2.2.22. It is, therefore, potentially affected by the following vulnerabilities :

  - When configured as a reverse proxy, improper use of the     RewriteRule and ProxyPassMatch directives could cause     the web server to proxy requests to arbitrary hosts.
    This could allow a remote attacker to indirectly send     requests to intranet servers.
    (CVE-2011-3368, CVE-2011-4317)

  - A heap-based buffer overflow exists when mod_setenvif     module is enabled and both a maliciously crafted     'SetEnvIf' directive and a maliciously crafted HTTP     request header are used. (CVE-2011-3607)

  - A format string handling error can allow the server to     be crashed via maliciously crafted cookies.
    (CVE-2012-0021)

  - An error exists in 'scoreboard.c' that can allow local     attackers to crash the server during shutdown.
    (CVE-2012-0031)

  - An error exists in 'protocol.c' that can allow     'HTTPOnly' cookies to be exposed to attackers through     the malicious use of either long or malformed HTTP     headers. (CVE-2012-0053)

  - An error in the mod_proxy_ajp module when used to     connect to a backend server that takes an overly long     time to respond could lead to a temporary denial of     service. (CVE-2012-4557)

Note that Nessus did not actually test for these flaws, but instead has relied on the version in the server's banner.

Several vulnerabilities have been found in the Apache HTTPD Server :

  - CVE-2011-3607 :
    An integer overflow in ap_pregsub() could allow local     attackers to execute arbitrary code at elevated     privileges via crafted .htaccess files.

  - CVE-2011-3368 CVE-2011-3639 CVE-2011-4317 :
    The Apache HTTP Server did not properly validate the     request URI for proxied requests. In certain reverse     proxy configurations using the ProxyPassMatch directive     or using the RewriteRule directive with the [P] flag, a     remote attacker could make the proxy connect to an     arbitrary server. This could allow the attacker to     access internal servers that are not otherwise     accessible from the outside.

  The three CVE ids denote slightly different variants of the same   issue.

  Note that, even with this issue fixed, it is the responsibility of   the administrator to ensure that the regular expression replacement   pattern for the target URI does not allow a client to append   arbitrary strings to the host or port parts of the target URI. For   example, the configuration

  ProxyPassMatch ^/mail(.*) http://internal-host$1

  is still insecure and should be replaced by one of the following   configurations :

  ProxyPassMatch ^/mail(/.*) http://internal-host$1 ProxyPassMatch   ^/mail/(.*) http://internal-host/$1

  - CVE-2012-0031 :
    An apache2 child process could cause the parent process     to crash during shutdown. This is a violation of the     privilege separation between the apache2 processes and     could potentially be used to worsen the impact of other     vulnerabilities.

  - CVE-2012-0053 :
    The response message for error code 400 (bad request)     could be used to expose 'httpOnly' cookies. This could     allow a remote attacker using cross site scripting to     steal authentication cookies.

This update contains the latest stable release of the Apace HTTP Server, version 2.2.22. This release fixes various bugs, and the following security issues :

  - Reject requests where the request-URI does not match the     HTTP specification, preventing unexpected expansion of     target URLs in some reverse proxy configurations.
    (CVE-2011-3368)

  - Fix integer overflow in ap_pregsub() which, when the     mod_setenvif module is enabled, could allow local users     to gain privileges via a .htaccess file. (CVE-2011-3607)

  - Resolve additional cases of URL rewriting with     ProxyPassMatch or RewriteRule, where particular     request-URIs could result in undesired backend network     exposure in some configurations. (CVE-2011-4317)

  - mod_log_config: Fix segfault (crash) when the     '%{cookiename}C' log format string is in use and a     client sends a nameless, valueless cookie, causing a     denial of service. The issue existed since version     2.2.17. (CVE-2012-0021)

  - Fix scoreboard issue which could allow an unprivileged     child process could cause the parent to crash at     shutdown rather than terminate cleanly. (CVE-2012-0031)

  - Fixed an issue in error responses that could expose     'httpOnly' cookies when no custom ErrorDocument is     specified for status code 400. (CVE-2012-0053)

http://www.apache.org/dist/httpd/CHANGES_2.2.22

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1391 advisory.

    - add security fixes for CVE-2011-3347, CVE-2011-3368 (#743901)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update fixes several security issues in the Apache2 webserver.

  - This update also includes several fixes for a mod_proxy     reverse exposure via RewriteRule or ProxyPassMatch     directives. (CVE-2011-3639 / CVE-2011-3368 /     CVE-2011-4317)

  - Fixed the SSL renegotiation DoS by disabling     renegotiation by default. (CVE-2011-1473)

  - Integer overflow in ap_pregsub function resulting in a     heap-based buffer overflow could potentially allow local     attackers to gain privileges. (CVE-2011-3607)

Also a non-security bug was fixed :

  - httpd-2.2.x-bnc727071-mod_authnz_ldap-utf8.diff: make     non-ascii eg UTF8 passwords work with mod_authnz_ldap.
    [bnc#727071]

This update brings Apache to version 2.2.12.

The main reason is the enablement of the Server Name Indication (SNI) that allows several SSL-enabled domains on one IP address (FATE#311973). See the SSLStrictSNIVHostCheck directive as documented in /usr/share/apache2/manual/mod/mod_ssl.html.en

Also the patch for the ByteRange remote denial of service attack (CVE-2011-3192) was refined and the configuration options used by upstream were added.

Introduce new config option: Allow MaxRanges Number of ranges requested, if exceeded, the complete content is served. default: 200 0|unlimited: unlimited none: Range headers are ignored. This option is a backport from 2.2.21.

Also fixed were

  - Denial of service in proxy_ajp when using a undefined     method. (CVE-2011-3348)

  - Exposure of internal servers via reverse proxy methods     with mod_proxy enabled and incorrect Rewrite or Proxy     Rules. This update also includes a newer     apache2-vhost-ssl.template, which disables SSLv2, and     allows SSLv3 and strong ciphers only. Please note that     existing vhosts will not be converted. (CVE-2011-3368)

This update fixes several security issues in the Apache2 webserver.

  - This update also includes several fixes for a mod_proxy     reverse exposure via RewriteRule or ProxyPassMatch     directives. (CVE-2011-3639 / CVE-2011-3368 /     CVE-2011-4317)

  - Fixed the SSL renegotiation DoS by disabling     renegotiation by default. (CVE-2011-1473)

  - Integer overflow in ap_pregsub function resulting in a     heap-based buffer overflow could potentially allow local     attackers to gain privileges. (CVE-2011-3607)

CVE MITRE reports :

An exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker.

Integer overflow in the ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif module is enabled, allows local users to gain privileges via a .htaccess file with a crafted SetEnvIf directive, in conjunction with a crafted HTTP request header, leading to a heap-based buffer overflow.

An additional exposure was found when using mod_proxy in reverse proxy mode. In certain configurations using RewriteRule with proxy flag or ProxyPassMatch, a remote attacker could cause the reverse proxy to connect to an arbitrary server, possibly disclosing sensitive information from internal web servers not directly accessible to attacker.

A flaw was found in mod_log_config. If the '%{cookiename}C' log format string is in use, a remote attacker could send a specific cookie causing a crash. This crash would only be a denial of service if using a threaded MPM.

A flaw was found in the handling of the scoreboard. An unprivileged child process could cause the parent process to crash at shutdown rather than terminate cleanly.

A flaw was found in the default error response for status code 400.
This flaw could be used by an attacker to expose 'httpOnly' cookies when no custom ErrorDocument is specified.

New httpd packages are available for Slackware 12.0, 12.1, 12.2, 13.0, 13.1, 13.37, and -current to fix security issues. The apr-util package has also been updated to the latest version.

This update fixes several security issues in the Apache2 webserver.

CVE-2011-3368, CVE-2011-4317: This update also includes several fixes for a mod_proxy reverse exposure via RewriteRule or ProxyPassMatch directives.

CVE-2011-3607: Integer overflow in ap_pregsub function resulting in a heap based buffer overflow could potentially allow local attackers to gain privileges

In addition to that the following changes were made :

  - new template file:
    /etc/apache2/vhosts.d/vhost-ssl.template allow TLSv1     only, browser match stuff commented out.

  - rc script /etc/init.d/apache2: handle reload with     deleted binaries by message to stdout only, but refrain     from sending signals.

The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers to send requests to intranet servers via a malformed URI containing an initial @ (at sign) character.

The remote host is affected by the vulnerability described in GLSA-201206-25 (Apache HTTP Server: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Apache HTTP Server.
      Please review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker might obtain sensitive information, gain privileges,       send requests to unintended servers behind proxies, bypass certain       security restrictions, obtain the values of HTTPOnly cookies, or cause a       Denial of Service in various ways.
    A local attacker could gain escalated privileges.
  Workaround :

    There is no known workaround at this time.

The remote host has one or more instances of NSM (Network and Security Manager) Server running, with version(s) prior to 2012.2R9. It is, therefore, affected by multiple vulnerabilities related to its Java and Apache installations.

The remote host is running a version of Mac OS X 10.7.x that is prior to 10.7.5. The newer version contains multiple security-related fixes for the following components :

  - Apache
  - BIND
  - CoreText
  - Data Security
  - ImageIO
  - Installer
  - International Components for Unicode
  - Kernel
  - Mail
  - PHP
  - Profile Manager
  - QuickLook
  - QuickTime
  - Ruby
  - USB

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
75787	openSUSE Security Update : apache2 (openSUSE-SU-2011:1217-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	high
56972	Apache HTTP Server mod_proxy Reverse Proxy Information Disclosure	Nessus	Web Servers	2011/11/29	2018/6/27	medium
57791	Apache 2.2.x < 2.2.22 Multiple Vulnerabilities	Nessus	Web Servers	2012/2/2	2018/6/29	medium
57851	Debian DSA-2405-1 : apache2 - multiple issues	Nessus	Debian Local Security Checks	2012/2/7	2021/1/11	medium
58252	Fedora 15 : httpd-2.2.22-1.fc15 (2012-1642)	Nessus	Fedora Local Security Checks	2012/3/7	2021/1/11	medium
68376	Oracle Linux 6 : httpd (ELSA-2011-1391)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2024/10/22	high
57090	SuSE 11.1 Security Update : Apache2 (SAT Patch Number 5482)	Nessus	SuSE Local Security Checks	2011/12/13	2021/1/19	medium
57089	SuSE 11.1 Security Update : Apache2 (SAT Patch Number 5344)	Nessus	SuSE Local Security Checks	2011/12/13	2021/1/19	high
57298	SuSE 10 Security Update : Apache2 (ZYPP Patch Number 7882)	Nessus	SuSE Local Security Checks	2011/12/14	2021/1/19	medium
57786	FreeBSD : apache -- multiple vulnerabilities (4b7dbfab-4c6b-11e1-bc16-0023ae8e59f0)	Nessus	FreeBSD Local Security Checks	2012/2/2	2021/1/6	medium
57892	Slackware 12.0 / 12.1 / 12.2 / 13.0 / 13.1 / 13.37 / current : httpd (SSA:2012-041-01)	Nessus	Slackware Local Security Checks	2012/2/13	2021/1/14	medium
75788	openSUSE Security Update : apache2 (openSUSE-SU-2012:0212-1)	Nessus	SuSE Local Security Checks	2014/6/13	2021/1/14	medium
79733	F5 Networks BIG-IP : Apache HTTP server vulnerabilities (SOL15889)	Nessus	F5 Networks Local Security Checks	2014/12/5	2021/3/10	medium
59678	GLSA-201206-25 : Apache HTTP Server: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2012/6/25	2021/1/6	high
77326	Juniper NSM < 2012.2R9 Multiple Java and Apache Vulnerabilities (JSA10642)	Nessus	Misc.	2014/8/22	2022/12/5	critical
62214	Mac OS X 10.7.x < 10.7.5 Multiple Vulnerabilities (BEAST)	Nessus	MacOS X Local Security Checks	2012/9/20	2024/5/28	critical

检测

插件搜索

high

medium

medium

medium

medium

high

medium

high

medium

medium

medium

medium

medium

high

critical

critical